General

  • Target

    JaffaCakes118_05e9ea62cba538f216fb83debfd38d398a06ba50549d9614805315f84c44033b

  • Size

    625KB

  • Sample

    241221-ya5m7axpfj

  • MD5

    0dde68f10d0af2afe04c76a5525e8ffd

  • SHA1

    3bc98854759d911783c1d09cad2f59187607dba3

  • SHA256

    05e9ea62cba538f216fb83debfd38d398a06ba50549d9614805315f84c44033b

  • SHA512

    72040c54eef609c502e4795b5ecf00c6399a1e6ab4e63f935c07bb9556c48259a13273cfaf2df0759b53b435cac08c53c50f8519bdfc832ed4779b0a938dcb58

  • SSDEEP

    12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZI:+w1lEKOpuYxiwkkgjAN8ZI

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142

Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Targets

    • Target

      JaffaCakes118_05e9ea62cba538f216fb83debfd38d398a06ba50549d9614805315f84c44033b

    • Size

      625KB

    • MD5

      0dde68f10d0af2afe04c76a5525e8ffd

    • SHA1

      3bc98854759d911783c1d09cad2f59187607dba3

    • SHA256

      05e9ea62cba538f216fb83debfd38d398a06ba50549d9614805315f84c44033b

    • SHA512

      72040c54eef609c502e4795b5ecf00c6399a1e6ab4e63f935c07bb9556c48259a13273cfaf2df0759b53b435cac08c53c50f8519bdfc832ed4779b0a938dcb58

    • SSDEEP

      12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZI:+w1lEKOpuYxiwkkgjAN8ZI

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Gozi family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks